How to sniff for wireless MAC addresses in area

A few days ago my apartment got broken in, and they took all the electronics, including my $1500 laptop.

We are pretty sure it's an inside job (as in someone from the same building), so I believe that the stuff is in someones apartment.

Is there any tool that tells you what wireless adapters are active within range? I have my laptops MAC address, so I could use that to find out who stole it. I think it's worth a shot.

Any help is appreciated thanks!

infinity

Posted 2009-09-17T16:25:35.337

Reputation: 283

2Did you ever find the thief? – FreeAsInBeer – 2014-09-22T20:02:51.767

@FreeAsInBeer Yeah, interested to know as well, just stumbled onto this question. – Secko – 2016-09-14T01:06:17.550

1Hi infinity, how'd this turn out for you? Did you find the culprit? – Drew – 2011-09-26T10:55:50.697

2(Just in case you got the MAC address from the configuration of a Time Machine backup: that's always the MAC address of the first network card, which often is the MAC of the ethernet connection, not of the AirPort.) – Arjan – 2009-09-17T16:52:51.567

Answers

Fire up Backtrack if you haven't already. Since you're not after traffic - just the level 2 address - this should be easy.

First, start airodump-ng and with the command

airodump-ng  --berlin 60 <wireless interface here>

You'll get a screen that looks like:

airodump

In the area marked client there is a column describing power in decibels (i.e. the more positive the number the better.

Second, walk around until you see your target MAC pop up on the screen in the client area.

Third, continue walking around using the strength readout to home in on the laptop.

Note: this is by no means incredibly accurate or guaranteed to work at all.

Greg Buehler

Posted 2009-09-17T16:25:35.337

Reputation: 1 150

You also answered my question at: http://electronics.stackexchange.com/questions/93359/sniffing-for-iphones?noredirect=1#comment181011_93359 -- free points if you copy the answer there

– William Entriken – 2013-12-11T20:05:35.800

MAC address is changeable, quite easily actually.

But, I guess you could always try with netstumbler, ethereal, or something alike.

Rook

Posted 2009-09-17T16:25:35.337

Reputation: 21 622

I was going to make the same recommendation, but I was trying to figure out if netstumbler can see other wireless cards or just access points... – Jared Harley – 2009-09-17T16:45:09.243

13I doubt it's likely that someone who has stolen the laptop will have changed the MAC address. – Arjan – 2009-09-17T16:45:10.163

I know that KisMac (a Mac OS X app, that can passively sniff Wireless networks) will show all wireless MACs that have associated with any base station that it can see traffic from [though it also sometimes shows the MAC of the host you're sniffing with], so I suspect that most of the other common wireless LAN tools can do it too.

(Be sure that you're looking for your laptop's wireless MAC!)

jrg

Posted 2009-09-17T16:25:35.337

Reputation: 745

The tools mentioned in ldigas' answer are the way to go (netstumbler, ethereal)

The trick is finding out exactly where near you he (or she) may be. That takes strong signal strength analysis and triangulation.

What you should do is tell the police if you find the address. They can then do the legal legwork to find out where they are connecting to and back track them. Let them do their job (hopefully). At a minimum make sure the MAC address is in the police report.

Craig

Posted 2009-09-17T16:25:35.337

Reputation: 281

How to sniff for wireless MAC addresses in area - My laptop got stolen

Answers